helm installation of Dex does not deploy functional Dex server about dex-k8s-authenticator HOT 5 CLOSED

I can take a closer look tomorrow, but my initial thoughts are that this is expected behaviour.

Dex provides a set of URL handlers, but nothing listening at '/` - think of it like an api-gateway.

Can you confirm the below URL returns a 200:

https://dex.ingress.dex-server.example.com/.well-known/openid-configuration

In order to authenticate via dex, you initiate the request against the ingress configured for dex-k8s-authenticator (so just browse to the ingress configured for that chart).

from dex-k8s-authenticator.

Also, I think you need to configure staticClients in the dex config (which links back to the dex-k8s-authenticator app) using the shared secret.

You can refer to these examples:

example dex-k8s-authenticator config
example dex config

from dex-k8s-authenticator.

Is it mandatory to deploy dex-k8s-authenticator.

Below URL is returning 200, Dex Server is running fine.
https://dex.ingress.dex-server.example.com/.well-known/openid-configuration

Is this expected, accessing https://dex.ingress.dex-server.example.com/callback in the browser throws error "Bad Request. User session error."?

Also, execution of kubectl prompts for https://microsoft.com/devicelogin instead of https://dex.ingress.dex-server.example.com

from dex-k8s-authenticator.

It's worth reading this - https://github.com/coreos/dex/blob/master/Documentation/kubernetes.md

This repo simply providers a web-ui that mimics what the example-app described in the above url does, but also provides a web-interface for it and makes it easier to integrate with kubectl

Just to clarify, this repo. is not associated with the official Dex project.

The key task that this helper performs is to fetch an ID token from Dex. It then provides a helper web-page that lets you configure your kubernetes kubeconfig with the correct credentials for the selected cluster, using the ID token provided by Dex. It would also let get a kubeconfig for different clusters, which could have different authentication backends.

Without such a tool, the flow is pretty painful to mimic by hand (think bash-scripts, and cURL),

So to clarify, if you want to use kubectl to authenticate via Dex, a tool like this (or similar as there are others) is usually needed.

Also, we provide the 'Dex' chart as a helper as we find people will deploy both Dex and dex-k8s-authenticator together. You certainly do not need to use our Dex chart - there is now a more recent official one, or you could roll your own (they generally tend to end up being very similar).

from dex-k8s-authenticator.

I believe this is resolved now, if not, feel free to open (related to #47)

from dex-k8s-authenticator.